SAMM - Verification - Revision history

Pravir Chandra at 00:55, 5 May 2009

2009-05-05T00:55:41Z

Pravir Chandra at 17:52, 2 May 2009

2009-05-02T17:52:29Z

Pravir Chandra at 03:10, 2 May 2009

2009-05-02T03:10:13Z

Pravir Chandra at 02:14, 2 May 2009

2009-05-02T02:14:54Z

Pravir Chandra at 22:57, 1 May 2009

2009-05-01T22:57:16Z

Pravir Chandra at 22:56, 1 May 2009

2009-05-01T22:56:17Z

Pravir Chandra: New page: http://www.opensamm.org/badges/small/V.png ===Design Review=== The Design Review (DR) Practice is focused on assessment of software design and architecture for security-related problems. ...

2009-05-01T22:51:46Z

New page: http://www.opensamm.org/badges/small/V.png ===Design Review=== The Design Review (DR) Practice is focused on assessment of software design and architecture for security-related problems. ...

New page

http://www.opensamm.org/badges/small/V.png

===Design Review===
The Design Review (DR) Practice is focused on assessment of software design and architecture for security-related problems. This allows an organization to detect architecture-level issues early in software development and thereby avoid potentially large costs from refactoring later due to security concerns.

Beginning with lightweight activities to build understanding of the security-relevant details about an architecture, an organization evolves toward more formal inspection methods that verify completeness in provision of security mechanisms. At the organization level, design review services are built and offered to stakeholders.

In a sophisticated form, provision of this Practice involves detailed, data-level inspection of designs and enforcement of baseline expectations for conducting design assessments and reviewing findings before releases are accepted.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Design_Review_-_1 http://www.opensamm.org/badges/small/DR1.png]
|[http://www.owasp.org/index.php/SAMM_-_Design_Review_-_2 http://www.opensamm.org/badges/small/DR2.png]
|[http://www.owasp.org/index.php/SAMM_-_Design_Review_-_3 http://www.opensamm.org/badges/small/DR3.png]
|}

===Code Review===
The Code Review (CR) Practice is focused on inspection of software at the source code level in order to find security vulnerabilities. Code-level vulnerabilities are generally simple to understand conceptually, but even informed developers can easily make mistakes that leave software open to potential compromise.

To begin, an organization uses lightweight checklists and for efficiency, only inspects the most critical software modules. However, as an organization evolves it uses automation technology to dramatically improve coverage and efficacy of code review activities.

Sophisticated provision of this Practice involves deeper integration of code review into the development process to enable project teams to find problems earlier. This also enables organizations to better audit and set expectations for code review findings before releases can be made.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Code_Review_-_1 http://www.opensamm.org/badges/small/CR1.png]
|[http://www.owasp.org/index.php/SAMM_-_Code_Review_-_2 http://www.opensamm.org/badges/small/CR2.png]
|[http://www.owasp.org/index.php/SAMM_-_Code_Review_-_3 http://www.opensamm.org/badges/small/CR3.png]
|}

===Security Testing===
The Security Testing (ST) Practice is focused on inspection of software in the runtime environment in order to find security problems. These testing activities bolster the assurance case for software by checking it in the same context in which it is expected to run, thus making visible operational misconfigurations or errors in business logic that are difficult to otherwise find.

Starting with penetration testing and high-level test cases based on the functionality of software, an organization evolves toward usage of security testing automation to cover the wide variety of test cases that might demonstrate a vulnerability in the system.

In an advanced form, provision of this Practice involves customization of testing automation to build a battery of security tests covering application-specific concerns in detail. With additional visibility at the organization level, security testing enables organizations to set minimum expectations for security testing results before a project release is accepted.
{| cellpadding="10"
|[http://www.owasp.org/index.php/SAMM_-_Security_Testing_-_1 http://www.opensamm.org/badges/small/ST1.png]
|[http://www.owasp.org/index.php/SAMM_-_Security_Testing_-_2 http://www.opensamm.org/badges/small/ST2.png]
|[http://www.owasp.org/index.php/SAMM_-_Security_Testing_-_3 http://www.opensamm.org/badges/small/ST3.png]
|}

@@ Line 1: / Line 1: @@
 {{OpenSAMM}}
 <div style="float:left; width:65%;">
 http://www.opensamm.org/badges/small/V.png

@@ Line 1: / Line 1: @@
 {{OpenSAMM}}
 [[Category:OWASP Software Assurance Maturity Model Project]]
 http://www.opensamm.org/badges/small/V.png
+<div style="width:100%; float:left;"><br/><br/>
 ===Design Review===
 The Design Review (DR) Practice is focused on assessment of software design and architecture for security-related problems. This allows an organization to detect architecture-level issues early in software development and thereby avoid potentially large costs from refactoring later due to security concerns.
@@ Line 29: / Line 34: @@
 In an advanced form, provision of this Practice involves customization of testing automation to build a battery of security tests covering application-specific concerns in detail.  With additional visibility at the organization level, security testing enables organizations to set minimum expectations for security testing results before a project release is accepted.
 {{SAMM-BadgeList|name=Security_Testing|abbr=ST}}

← Older revision		Revision as of 02:14, 2 May 2009
Line 1:		Line 1:
		+	{{OpenSAMM}}
	[[Category:OWASP Software Assurance Maturity Model Project]]		[[Category:OWASP Software Assurance Maturity Model Project]]
	http://www.opensamm.org/badges/small/V.png		http://www.opensamm.org/badges/small/V.png

← Older revision		Revision as of 22:57, 1 May 2009
Line 1:		Line 1:
	[[Category:OWASP Software Assurance Maturity Model Project]]		[[Category:OWASP Software Assurance Maturity Model Project]]
		+	http://www.opensamm.org/badges/small/V.png

−	~~http://www.opensamm.org/badges/small/V.png~~

	===Design Review===		===Design Review===

← Older revision		Revision as of 22:56, 1 May 2009
Line 1:		Line 1:
		+	[[Category:OWASP Software Assurance Maturity Model Project]]
		+
	http://www.opensamm.org/badges/small/V.png		http://www.opensamm.org/badges/small/V.png

@@ Line 10: / Line 10: @@
 In a sophisticated form, provision of this Practice involves detailed, data-level inspection of designs and enforcement of baseline expectations for conducting design assessments and reviewing findings before releases are accepted.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Design_Review|abbr=DR}}
@@ Line 23: / Line 19: @@
 Sophisticated provision of this Practice involves deeper integration of code review into the development process to enable project teams to find problems earlier. This also enables organizations to better audit and set expectations for code review findings before releases can be made.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Code_Review|abbr=CR}}
@@ Line 36: / Line 28: @@
 In an advanced form, provision of this Practice involves customization of testing automation to build a battery of security tests covering application-specific concerns in detail.  With additional visibility at the organization level, security testing enables organizations to set minimum expectations for security testing results before a project release is accepted.
-{| cellpadding="10"
+{{SAMM-BadgeList|name=Security_Testing|abbr=ST}}